Three things that would not have scaled to 70 roles:
- The Python and Ansible dependency pins were about to be copied into every
role. They now live once in molecule-shared/, which scenarios reference
relatively, so they cannot drift apart.
- The helper container images used for probing were hardcoded inline. They
are pinned once in molecule-shared/vars.yml, carry `# renovate:`
annotations, and a custom manager in .github/renovate.json keeps them
current - verified with a local Renovate dry run, which offers
curl 8.11.1 -> 8.21.0 and python 3.13 -> 3.14-alpine. Seventy invisible
hardcodes is the blindness class we have been removing elsewhere.
- Running a scenario meant knowing the venv and cd incantation. `just
molecule <role>` does it, and with no argument lists the roles that have
a scenario.
Molecule is deliberately not wired into prek: a run takes minutes, pulls
images and needs Docker, which is fine on request and not fine per commit.
docs/molecule-testing.md covers how to run and write these, including the
four things a role here needs that a standalone role does not. AGENTS.md
points at it rather than carrying the detail.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every dependency bump in the housekeeping list was already automerging,
but as a pull request - which meant an email and an open PR for every
bump even when it merged itself. Branch-push automerge makes green bumps
invisible; a failing one still surfaces as a pull request. The new
Matrix i18n workflow gates the i18n/requirements.txt ones with a real
exercise of the translation toolchain.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BhJbmhyUpt4qSrKD9cbJ5A
The seven pinned com.devture.ansible.role.* roles are maintained by the
same people who review these PRs; their releases are already the review.
Same branch-push automerge (and the same lint gate) as MASH role bumps.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BhJbmhyUpt4qSrKD9cbJ5A
Same rule mash-playbook has been running in production: role bumps from
mother-of-all-self-hosting merge via branch push (no PR) once the branch's
CI checks pass. The trust basis is the role repositories' own gates - each
release is cut by Molecule-verified, autotagged merges over there.
Bumps of devture roles and everything else keep their PRs. Extending the
same treatment to devture roles (here and in mash-playbook) is a discussed
follow-up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BhJbmhyUpt4qSrKD9cbJ5A
This lets Renovate periodically refresh flake.lock, keeping the
nixpkgs and agru inputs of the development shell up to date.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Prevents Renovate from proposing "major" updates to the registry-only
calver tags (vYY.MM[.PATCH]), which break further updates and
self-building. See the previous commit for details.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
